CVE-2021-46880: 
NixOS vulnerability analysis and mitigation

CVE-2021-46880 affects LibreSSL before version 3.4.2 and OpenBSD before version 7.0 errata 006. The vulnerability exists in the x509/x509_verify.c component, where an authentication bypass could occur because an error for an unverified certificate chain is sometimes discarded (CVE Details, NVD).

The vulnerability is present in the x509/x509_verify.c component of LibreSSL and OpenBSD. The issue occurs when the verification callback is in use, instructing the verifier to continue unconditionally, which could lead to incorrect security decisions being made. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to authentication bypass, potentially resulting in disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The critical CVSS score indicates the severe nature of this security flaw (NetApp Advisory).

The vulnerability has been fixed in LibreSSL version 3.4.2 and OpenBSD 7.0 errata 006. Users should upgrade to these versions or later to address the security issue. The fix involves correcting how the x509 verifier handles errors during certificate chain verification (LibreSSL Release Notes, OpenBSD Patch).